# Weak Password Requirements (CWE-521)

The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

- Prevalence: 높음 자주 악용됨
- Impact: 높음 1개의 높은 심각도 규칙
- Prevention: 문서화됨 2개의 수정 예시

**OWASP:** Identification and Authentication Failures (A07:2021-Identification and Authentication Failures) - #7

## Description

Without strong password requirements, users often choose weak, easily guessable passwords. This makes brute-force and dictionary attacks more likely to succeed.

## Prevention

2개의 Shoulder 탐지 규칙을 기반으로 한 Weak Password Requirements 예방 전략.

### Go

Enforce minimum 12-character passwords with complexity requirements

### JavaScript

Require minimum 12 characters with complexity checks or use a password strength library

## Warning Signs

- [HIGH] Password validation at ... lacks proper complexity requirements
- [HIGH] password validation that lacks proper complexity requirements, making accounts vulnerable to brute f

## Consequences

- 권한 획득
- 보호 메커니즘 우회

## Mitigations

- 최소 비밀번호 길이를 강제하세요(12자 이상 권장)
- 비밀번호를 알려진 유출 데이터베이스와 대조하세요
- 다중 인증(MFA)을 구현하세요

## Detection

- Total rules: 2
- Languages: go, javascript, typescript

## Rules by Language

### Go (1 rules)

- **Weak Password Policy** [MEDIUM]: Password validation requires fewer than 8 characters.
  - Remediation: Enforce minimum password length of 12+ characters with complexity requirements.

```go
func validatePassword(password string) error {
    if len(password) < 12 {
        return errors.New("password must be at least 12 characters")
    }
    // Add complexity checks: uppercase, lowercase, digit, special char
    return nil
}
```

Learn more: https://shoulder.dev/learn/go/cwe-521/weak-password-policy

### Javascript (1 rules)

- **Weak Password Policy** [HIGH]: Detects password validation that lacks proper complexity requirements, making accounts vulnerable to brute force attacks.
  - Remediation: Implement strong password requirements:

```javascript
// ✅ SAFE - Strong password policy
function validatePassword(password) {
  if (password.length < 12) {
    throw new Error('Password must be at least 12 characters');
  }

  const hasUppercase = /[A-Z]/.test(password);
  const hasLowercase = /[a-z]/.test(password);
  const hasDigit = /\d/.test(password);
  const hasSpecial = /[!@#$%^&*(),.?":{}|<>]/.test(password);

  if (!hasUppercase || !hasLowercase || !hasDigit || !hasSpecial) {
    throw new Error(
      'Password must contain uppercase, lowercase, digit, and special character'
    );
  }

  return true;
}
```

### Typescript (1 rules)

- **Weak Password Policy** [HIGH]: Detects password validation that lacks proper complexity requirements, making accounts vulnerable to brute force attacks.
  - Remediation: Implement strong password requirements:

```javascript
// ✅ SAFE - Strong password policy
function validatePassword(password) {
  if (password.length < 12) {
    throw new Error('Password must be at least 12 characters');
  }

  const hasUppercase = /[A-Z]/.test(password);
  const hasLowercase = /[a-z]/.test(password);
  const hasDigit = /\d/.test(password);
  const hasSpecial = /[!@#$%^&*(),.?":{}|<>]/.test(password);

  if (!hasUppercase || !hasLowercase || !hasDigit || !hasSpecial) {
    throw new Error(
      'Password must contain uppercase, lowercase, digit, and special character'
    );
  }

  return true;
}
```